US7328451B2 - Network firewall policy configuration facilitation - Google Patents
Network firewall policy configuration facilitation Download PDFInfo
- Publication number
- US7328451B2 US7328451B2 US10/611,635 US61163503A US7328451B2 US 7328451 B2 US7328451 B2 US 7328451B2 US 61163503 A US61163503 A US 61163503A US 7328451 B2 US7328451 B2 US 7328451B2
- Authority
- US
- United States
- Prior art keywords
- firewall
- packets
- user
- questionable
- policy
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active, expires
Links
- 238000012986 modification Methods 0.000 claims abstract description 95
- 230000004048 modification Effects 0.000 claims abstract description 95
- 238000000034 method Methods 0.000 claims abstract description 88
- 238000012545 processing Methods 0.000 claims description 34
- 230000006870 function Effects 0.000 claims description 30
- 230000000903 blocking effect Effects 0.000 claims description 23
- 239000003607 modifier Substances 0.000 claims description 15
- 238000001914 filtration Methods 0.000 claims description 14
- 238000002372 labelling Methods 0.000 claims 1
- 230000008569 process Effects 0.000 description 53
- 238000004891 communication Methods 0.000 description 30
- 239000003795 chemical substances by application Substances 0.000 description 11
- 238000010586 diagram Methods 0.000 description 6
- 230000003287 optical effect Effects 0.000 description 5
- 230000003993 interaction Effects 0.000 description 4
- 230000007246 mechanism Effects 0.000 description 4
- 238000007726 management method Methods 0.000 description 3
- 238000012913 prioritisation Methods 0.000 description 3
- 238000004590 computer program Methods 0.000 description 2
- 238000013523 data management Methods 0.000 description 2
- 230000001419 dependent effect Effects 0.000 description 2
- 238000007689 inspection Methods 0.000 description 2
- 230000003252 repetitive effect Effects 0.000 description 2
- 239000004065 semiconductor Substances 0.000 description 2
- 230000003466 anti-cipated effect Effects 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 238000013475 authorization Methods 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 230000015572 biosynthetic process Effects 0.000 description 1
- 239000000872 buffer Substances 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000013070 change management Methods 0.000 description 1
- 230000007812 deficiency Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000002452 interceptive effect Effects 0.000 description 1
- 238000011835 investigation Methods 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 230000003362 replicative effect Effects 0.000 description 1
- 238000010561 standard procedure Methods 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0263—Rule management
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
Definitions
- the present invention is generally related to computer systems and, more particularly, is related to electronic network security systems.
- Firewalls are the cornerstone of security for communications networks and resources attached to those networks.
- Network-based firewalls offer advantages over host-based firewalls, especially with respect to providers such as BellSouth that wish to offer such security services to broadband customers.
- firewalls are difficult to configure and traditionally are administered by experts.
- Network-based firewalls are difficult to customize due to their remoteness from the user because they are typically located in the provider network rather than on the user's computer and users are likely separated from the administrators of these firewalls.
- firewall policy is determined for the sake of business operations, that policy is kept as simple as possible in order to better ensure security and to keep change management costs down resulting in firewall policies that tend to be restrictive rather than enabling.
- firewalls such as software firewalls installed on PCs that connect to the Internet via broadband (e.g., DSL)
- DSL broadband
- consumers are paying for the firewall and should be able to determine their policy, and not have firewall policies dictated to them.
- firewalls for consumers cannot be overly restrictive just to simplify matters, yet a way must be found to aid the consumer in properly configuring the firewall so that good security is obtained.
- Preferred embodiments of the present invention provide for network firewall policy configuration facilitation.
- a firewall facilitation coordinator configured to receive a request to add an application not currently supported by a user's firewall policy, and to generate a time window during which a user can run the application.
- a policy modification agent is configured to communicate with the firewall facilitation coordinator.
- the policy modification agent is further configured to receive a firewall modification request from the firewall facilitation coordinator and to modify the user's firewall policy.
- one embodiment can be broadly summarized by the following steps: notifying a coordinating entity of a request to modify a firewall policy to incorporate filtering rules to allow communications or packets from a new application to pass through the network-based firewall without being blocked; notifying a policy modifier of the modification request; sending a user an indication of a time period during which the user can exercise a new application; and examining the user-originated communications or packets traversing the firewall during that time period and modifying the user's policy such that packets associated with the new application are allowed to pass through the firewall.
- FIG. 1 is a block diagram depicting a preferred embodiment of a system for network firewall policy configuration facilitation.
- FIG. 2 is a block diagram depicting a preferred embodiment of a firewall facilitation coordinator of a system for network firewall policy configuration facilitation.
- FIG. 3 is a block diagram depicting a preferred embodiment of a policy modification agent of a system for network firewall policy configuration facilitation.
- FIG. 4 is a flow chart depicting general functionality, in accordance with a preferred embodiment, of an implementation of network firewall policy configuration facilitation.
- FIGS. 5A-5D are flowcharts depicting more specific functionality, in accordance with a preferred embodiment, of an implementation of network firewall policy configuration facilitation.
- FIG. 1 is a block diagram depicting a preferred embodiment of a system 100 for network firewall policy configuration facilitation.
- the system 100 includes a network based firewall 102 , a protected/access network 103 , a provider network 104 , a host processing device such as a host computer 106 , a firewall facilitation coordinator processing device (FFC) 108 and user processing device 110 .
- FFC firewall facilitation coordinator processing device
- the host computer 106 is located at a user's location and administered by the user or an administrator on behalf of the user.
- the network based firewall 102 is deployed in a service provider's network, such as a telecommunications provider network, yet is accessible to and customizable by the user.
- the FFC 108 is located between the host computer 106 and the network based firewall 102 .
- an optional out of band communications link 109 is available for accessing the FFC 108 .
- the user's processing device 110 communicates with the host device 106 via a communications link 113 , the can be a wireline, wireless, local area network connection, among others.
- the FFC 108 provides a mechanism for the user to access the network based firewall 102 . Once the user has accessed the network based firewall 102 , the user can utilize the policy modification agent 140 to modify firewall processes 136 that the user has authorization to modify.
- the user accesses the FFC 108 when they wish to use an application not currently accounted for in the firewall policy.
- the FFC 108 notifies the network based firewall 102 of the modification request.
- the policy modification agent 140 acknowledges the modification request to the FFC 108 , which subsequently acknowledges the request back to the user.
- the user also receives a time window indication during which the user can exercise the new application.
- the new application will try to communicate through the network based firewall 102 . Since the network based firewall 102 is aware that the user wishes to configure a new application into the firewall policy, the network based firewall 102 does not block the application's communication.
- the policy modification agent 140 examines the communication (i.e., packets), and modifies the user's firewall policy such that this application is allowed to pass through unhindered. An acknowledgement of completion from the policy modification agent 140 can be sent to the FFC 108 and on to the user's processing device 110 .
- the protected/access network 103 and the provider network 104 may be any type of communications network employing any network topology, transmission medium, or network protocol.
- a network may be any public or private packet-switched or other data network, including the Internet, circuit-switched network, such as a public switch telecommunications network (PSTN), wireless network, or any other desired communications infrastructure and/or combination of infrastructure.
- PSTN public switch telecommunications network
- the user processing device 110 is preferably a personal computer configured to communicate with the FFC 108 and the host computer 106 .
- the host computer 106 , FFC 108 and network based firewall 102 are located in the service provider's network.
- the user processing device is part of a local network with the host computer 106 remotely located from the user processing device 110 and managed by a system administrator.
- the host computer 106 and user processing device 110 are colocated at a user location, among others.
- the host computer 106 is preferably configured to communicate with the network based firewall 102 either directly or alternatively via the provider network 104 .
- the host computer 106 is configured as a digital computer that includes, inter alia, a processor 120 and memory 122 .
- the user processing device 110 and FFC 108 are configured as digital computers having a processor, memory, local interfaces, system interfaces, among others.
- I/O devices or peripherals
- the local interface 124 can be, for example but not limited to, one or more buses or other wired or wireless connections, as is known in the art.
- the local interface 124 may have additional elements, which are omitted for simplicity, such as controllers, buffers (caches), drivers, repeaters, and receivers, to enable communications. Further, the local interface may include address, control, and/or data connections to enable appropriate communications among the aforementioned components.
- the processor 120 is a hardware device for executing software, particularly that stored in memory 122 .
- the processor 120 can be any custom made or commercially available processor, a central processing unit (CPU), an auxiliary processor among several processors, a semiconductor based microprocessor (in the form of a microchip or chip set), a macroprocessor, or generally any device for executing software instructions.
- CPU central processing unit
- auxiliary processor among several processors
- semiconductor based microprocessor in the form of a microchip or chip set
- macroprocessor or generally any device for executing software instructions.
- the memory 122 can include any one or combination of volatile memory elements (e.g., random access memory (RAM, such as DRAM, SRAM, SDRAM, etc.)) and nonvolatile memory elements (e.g., ROM, hard drive, tape, CDROM, etc.). Moreover, the memory 122 may incorporate electronic, magnetic, optical, and/or other types of storage media. Note that the memory 122 can have a distributed architecture, where various components are situated remote from one another, but can be accessed by the processor 120 .
- the software and/or firmware in memory 122 may include one or more separate programs, each of which comprises an ordered listing of executable instructions for implementing logical functions.
- the software in the memory 122 can include logic 130 , such as logic for firewall policy configuration facilitation and a suitable operating system (O/S) 128 .
- the FFC 108 is resident in memory 122 of the host computer 106 .
- the FFC 108 is resident in memory of a remote computing devices for management and administrative purposes.
- the operating system essentially controls the execution of other computer programs, and provides scheduling, input-output control, file and data management, memory management, and communication control and related services.
- the logic 130 is a source program, executable program (object code), script, or any other entity comprising a set of instructions to be performed.
- the program needs to be translated via a compiler, assembler, interpreter, or the like, which may or may not be included within the memory 122 , so as to operate properly in connection with the O/S.
- logic 130 can be written as (a) an object oriented programming language, which has classes of data and methods, or (b) a procedure programming language, which has routines, subroutines, and/or functions, for example but not limited to, C, C++, Pascal, Basic, Fortran, Cobol, Perl, Java, and Ada.
- the I/O devices may include input devices, for example but not limited to, a keyboard, mouse, scanner, microphone, etc. Furthermore, the I/O devices may also include output devices, for example but not limited to, a printer, display, etc. The I/O devices may further include devices that communicate both inputs and outputs, for instance but not limited to, a modulator/demodulator (modem; for accessing another device, system, or network), a radio frequency (RF) or other transceiver, a telephonic interface, a bridge, a router, etc. Finally, I/O 126 may couple to the provider network 104 .
- modem for accessing another device, system, or network
- RF radio frequency
- I/O 126 may couple to the provider network 104 .
- logic 130 can be stored on any computer-readable medium for use by or in connection with any computer related system or method.
- the logic 130 can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor-containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions.
- a “computer-readable medium” can be any means that can store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
- the computer-readable medium can be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. More specific examples (a nonexhaustive list) of the computer-readable medium would include the following: an electrical connection (electronic) having one or more wires, a portable computer diskette (magnetic), a random access memory (RAM) (electronic), a read-only memory (ROM) (electronic), an erasable programmable read-only memory (EPROM, EEPROM, or Flash memory) (electronic), an optical fiber (optical), and a portable compact disc read-only memory (CDROM) (optical).
- an electrical connection having one or more wires
- a portable computer diskette magnetic
- RAM random access memory
- ROM read-only memory
- EPROM erasable programmable read-only memory
- EPROM erasable programmable read-only memory
- CDROM portable compact disc read-only memory
- the computer-readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via for instance optical scanning of the paper or other medium, then compiled, interpreted or otherwise processed in a suitable manner if necessary, and then stored in a computer memory.
- the logic 130 can be implemented with any or a combination of the following technologies, which are each well known in the art: a discrete logic circuit(s) having logic gates for implementing logic functions upon data signals, an application specific integrated circuit (ASIC) having appropriate combinational logic gates, a programmable gate array(s) (PGA), a field programmable gate array (FPGA), etc.
- the host computer 106 further includes a network interface 132 (such as an adapter card, e.g., network interface card (NIC), among others).
- the network interface 132 is utilized for communicating with the network based firewall 102 via a network interface 134 .
- the network-based firewall 102 includes the network interface 134 , firewall process 136 including computing processing (not shown) such as processor, system interfaces, local interfaces, among others, memory 138 , a protected network 103 , such as an intranet, and a network interface 144 for communicating with the provider network 104 .
- the software and/or firmware in memory 138 may include one or more separate programs, each of which comprises an ordered listing of executable instructions for implementing logical functions.
- the software in the memory 138 can include a policy modification agent (PMA) logic 140 , and a suitable operating system (O/S) 139 .
- the operating system 139 preferably controls the execution of other computer programs, and provides scheduling, input-output control, file and data management, memory management, and communication control and related services, among others.
- the firewall facilitation coordinator 108 is software or logic residing on a computing device.
- the FFC 108 includes a network interface 146 for communicating with the network interface 134 of the network-based firewall 102 and also the network interface 132 of the host computer 106 , via the protected/access network 103 .
- FIG. 2 is a block diagram depicting a preferred embodiment of a firewall facilitation coordinator (FFC) 108 of a system for network firewall policy configuration facilitation.
- the FFC 108 is preferably positioned in a protected network where a host computer and a user processing device reside.
- the firewall process 136 is located between the protected network 103 and the Internet 104 , to shield the protected network 103 from threats originating on the Internet 104 .
- the FFC 108 can encompass a number of simpler modules.
- the modules include a secure transceiver 202 , a FFC controller 204 , a user notification authenticator 206 , a user database 208 , and a firewall policy configuration/modification window generator 210 and the network interface 146 .
- these modules are software process, modules, or routines, or alternatively are implemented in hardware.
- the user database 208 could be a separate external database connected to the FFC 108 via the protected network 103 .
- the FFC 108 receives notifications at the secure transceiver 202 sent by the user's processing device 110 when the user wishes to configure a “new” application by incorporating new filtering rules into the user's firewall policy that specifically allows the communications or packets to/from that application to pass through the firewall without being blocked.
- the notifications or requests are sent by the user's processing device 110 via the host computer 106 utilizing the protected network 103 (i.e., in-band communication) or via a separate method, such as using a telephone (not shown) (i.e., out-of-band communication). Out-of-band communication may be preferred in some circumstances.
- the FFC 108 includes modem connections for communication with a telephone system, or attachment to an automated interactive telephone menu system that allows the user to select and communicate the request and receive acknowledgements and other resulting information from the FFC 108 .
- the network interface 146 and 134 connect to the protected network 103 and transmit/receive the communications over the network.
- the method of notification includes email, web access, or among other notification methods.
- the FFC 108 includes a mechanism to receive email.
- the FFC 108 could be interfaced to a separate device or server or software application, which receives email.
- the FFC 108 includes a web server that is attached to, or communicates with, a separate supporting web server, which the user accesses over the provider network 104 .
- standard secure methods that include cryptographic authentication and encryption are used (e.g., encrypted mail or SSL-protected web access, or SSH or IPsec) for communication between the host computer 106 and the FFC 108 .
- the FFC 108 when the FFC 108 receives a notification to add a “new” application, the FFC 108 decodes or decrypts the notification as needed using the capabilities of the secure transceiver 202 , which may utilize standard decryption methods such as included in SSL, SSH, or IPsec, and interprets the notification to understand the user's request. Since the number of users/customers is anticipated to be great, a separate module and database are preferably used for authentication.
- the FFC 108 includes a database 208 that is configured with a list of authorized users.
- the user notification authenticator 206 interacts with the database 208 to authenticate the user prior to acting on the request via standard authentication methods such as included in SSL, SSH, or IPsec based for instance upon shared encryption keys/secrets/passwords or upon cryptographic certificates. If the user is authenticated as an authorized user, the firewall policy configuration/window generator 210 generates a time window during which the user can exercise (run) the “new” application. Optionally, additional information in the notification or request and/or the user database 208 may be consulted to determine the best time window to offer the user.
- the FFC 108 communicates this information to the PMA 140 on the network-based firewall 102 .
- communications between the FFC 108 and the network-based firewall 102 utilize standard secure methods (e.g., SSL, SSH, IPsec). Non-standard secure methods or non-secure methods may also be used in an alternate embodiment of the invention.
- in-band or out-of-band communications, or both can be utilized between the FFC 108 and PMA 140 .
- the FFC 108 Upon receipt of a positive acknowledgement sent to the FFC 108 from the PMA 140 indicating that the time window is acceptable to the firewall, the FFC 108 sends an acknowledgement back to the user's processing device 110 via, for example the secure transceiver 202 communicating to the host computer 106 .
- This acknowledgement preferably includes the time window information, among other information. If a negative acknowledgement is received from the PMA 140 , the FFC controller 204 may instruct the firewall policy configuration/modification window generator 210 of the FFC 108 to calculate another time window and try again.
- the FFC 108 may keep a record of previous time window requests sent to the PMA 140 that have been positively acknowledged, so that it can use this record to avoid making any future time window requests for time windows that are already scheduled in the PMA 140 and therefore will not be available.
- the FFC 108 may then send a “failed” acknowledgement to the user's processing device 110 and notify others, such as administrators or help desk staff as appropriate via standard methods such as email, pager alerts, or various alarms, and optionally indicate in the “failed” user acknowledgement that the user or customer should request assistance.
- the FFC 108 asks the user via the user's processing device 110 if the user wishes to continue the repetitive time window generation attempts until satisfactory results are obtained, or until optional additional configurable limits are exceeded.
- the FFC 108 will receive a positive acknowledgment from the PMA 140 upon completion.
- the FFC 108 may receive, and forward to the user's processing device 110 , an unqualified completion message.
- the FFC 108 may receive a qualified completion message, such as a message that the user's firewall policy was successfully modified but that questionable packets were also detected during the time window, that these particular packets were not included in the policy's new (updated) filtering rules, and that the user may need to repeat the entire policy modification process if the application still does not work properly through the firewall.
- a qualified completion message such as a message that the user's firewall policy was successfully modified but that questionable packets were also detected during the time window, that these particular packets were not included in the policy's new (updated) filtering rules, and that the user may need to repeat the entire policy modification process if the application still does not work properly through the firewall.
- the “new” application's communications may be able to traverse the firewall successfully if those questionable packets were truly not associated with the “new” application but rather were associated with other applications or software process, either already incorporated into rules with the user's policy, or else not incorporated.
- Questionable packets might arise from other applications resident on the host computer 106 that coincidentally sent packets through the firewall during the time window unbeknownst to the user.
- “allowed” or “authorized” application might be designed to communicate periodically, at random intervals, or when triggered by some event not visible to the user.
- Trojans, spy-ware, and mal-ware of various sorts might autonomously send packets at any time.
- the newly configured policy for the “new” application should incorporate “new” changes that reflect only that application, not other applications or software process. Therefore, in a preferred embodiment questionable packets are initially excluded from the firewall policy modifications under the assumption that they are unlikely to be associated with the “new” application. Categorizing packets as “questionable” is described below with regard to the functionality of the PMA 140 .
- the user may notice that the application does not function properly.
- the user should consider information contained in the qualified acknowledgement from the FFC 108 .
- the user may choose to repeat the policy modification process.
- the PMA 140 has knowledge of the questionable packets previously excluded, and will attempt to properly incorporate this knowledge when the policy modification process is reattempted.
- the PMA 140 can include them one at a time into the modified policy, or in combinations.
- the FFC 108 may receive a “failed” message from the PMA 140 , i.e. if the user has continued to repeat the policy modification process for the same application a number of times, for instance, more than 3 times.
- the number of times is preferably configurable and can be made dependent upon the type of application since the firewall policies for some types of applications, for instance games, are more difficult to modify successfully than others.
- a “failed” message indicates that the user has been unable to get the “new” application to work properly through the firewall process 136 even though a number of policy modifications via the FFC 108 and PMA 140 have been done.
- a “failed” acknowledgement is preferably conveyed to the user's processing device 110 by the FFC 108 , and to administrators and/or helpdesk staff can be notified so that they can pro-actively assist the user.
- the FFC 108 asks the user if they wish to continue the repetitive policy modification attempts until satisfactory results are obtained, or until optional additional configurable limits are exceeded. Any reasonable interaction protocol or menu tree could be used for this purpose, with any amount of designed-in variation as desired via options to be selected by the user either during the interaction or in an initial set-up process.
- FIG. 3 is a block diagram depicting a preferred embodiment of a policy modification agent (PMA) 140 of a system for network firewall policy configuration facilitation.
- the PMA 140 resides on (or is attached to) the network-based firewall 102 and is adapted to receive communications from the FFC 108 .
- the PMA 140 is configured to communicate with and influence the firewall process 136 that include a security policy encompassing a set of filtering rules.
- the PMA 140 includes a number of modules, such as a secure transceiver 302 , PMA controller 304 , policy modifier 306 , blocking history checker 308 , and blocking database 310 .
- the secure transceiver 302 is responsible for adding encryption and authentication to communications transmitted from the PMA 140 , and for authenticating and decrypting communications received by the PMA 140 .
- the PMA controller 304 provides overall control functionality to the PMA 140 , for instance coordinating the actions of the various modules, providing time window packet observations to the blocking history checker 308 , and providing information to the policy modifier 306 regarding policy change requirements.
- the policy modifier 306 modifies the firewall policy 312 , and also communicates the observations of the firewall packet inspector 314 to the PMA controller 304 during the time window.
- the blocking history checker 308 uses time window packet observations from the PMA controller to check the blocking history database 310 for previously observed packets, previous policy modification attempts and results, etc.
- the blocking database 310 can be used to record any desired information helpful to the policy modification process, including for instance previously observed packets associated with a particular host, previously observed packets associated with a particular application, packets observed during particular time windows, results of previous attempts to modify the firewall policy associated with particular hosts and/or applications, etc.
- these modules are software process, modules or routines.
- the modules can be partly or fully implemented in hardware.
- the PMA 140 preferably utilizes existing firewall process 136 components or modules, which typically includes some form or arrangement of firewall policy 312 , firewall packet inspector 314 , and firewall filter 316 .
- the secure transceiver 302 via the network interface 134 receives a time window request for a particular user and application from the FFC 108 in order to add a new application to the user's/customer's firewall policy as described above, the PMA controller 304 checks to see if the time window is available, and if available the PMA controller 304 sends an acknowledgement to the FCC 108 and likewise schedules the time window. If the time window is unavailable, the PMA 140 sends this information to the FFC 108 so that the FFC 108 can request a different time window.
- the PMA 140 may optionally include information on currently available time periods so as to aid the FFC 108 in selecting another time window, in which case the FFC 108 may then optionally keep a record of this information so that it can consult this record when sending future time window requests to the PMA, 140 in order to select or generate time windows which are likely to be currently unscheduled and thus acceptable to the PMA 140 .
- the secure transceiver 302 via the network interface 134 is in communication with the FFC 108 to send and receive messages containing the above-mentioned information and acknowledgements to/from the FFC 108 . Information from the secure transceiver 302 is communicated to the PMA controller 304 .
- the PMA controller 304 communicates with both the policy modifier 306 and the blocking history checker 308 .
- the PMA controller 304 communicates this to the policy modifier 306 , which communicates with the firewall packet inspector 314 to observe the packets flowing through the firewall associated with the user/customer, presuming that these should be associated with the new application being exercised at that time.
- the blocking history checker 308 provides the PMA controller 304 access to the blocking database 310 that includes information on questionable packets associated with that user/customer and information regarding any previous policy modification attempts for the new application.
- the policy modifier 306 also communicates with the firewall policy 312 for the purpose of modifying the policy filtering rules as needed, and for negotiating the manner in which these rules can be modified (which may be dependent upon the particular firewall brand, model, and implementation).
- the firewall process 136 receives packets from the network interface 134 , 144 , each network interface serving to connect the firewall to a different network as was indicated in FIG. 1 .
- the firewall packet inspector 314 is directed by the policy modifier 306 to inspect or examine all the received packets associated with that time window's particular user/customer to determine at least the contents of the packet headers, including the originating and destination IP addresses, the originating and destination port numbers, and the protocol number.
- data in the packet's payloads may also be inspected, particularly for complex protocols or application interactions that exchange information needed by the firewall in the packet payloads in addition to the packet headers.
- the firewall packet inspector 314 utilizes information from the firewall policy 312 that has been modified as needed by the policy modifier 306 to determine how to perform the inspection or examination of the packets, for instance by selecting certain aspects or components of the packets headers and payloads to observe while ignoring other aspects or components.
- the packets are sent to the firewall filter 316 for filtering, during which they may either be blocked or allowed to pass.
- the filtered packets that are allowed to pass are typically sent to be re-transmitted via a different network interface 134 , 144 than the network interface 134 , 144 that originally received the packets.
- the filtered packets are handled in this manner so that packets originating in either network can potentially flow through the firewall to reach destinations in the other network, while being inspected and filtered in passing to achieve security by eliminating unauthorized packets or packets associated with unauthorized/dangerous communications that are purposely not allowed to traverse the firewall to reach the other network (or particular destinations on the other network), thus providing protection.
- FIG. 4 is a flow chart depicting general functionality (or method), in accordance with a preferred embodiment, of an implementation of network firewall policy configuration facilitation.
- the process begins at 402 .
- a request is received at a firewall facilitation coordinator (FFC) to modify a user's firewall policy.
- the FFC sends the user a time window for exercising a new application.
- packets associated with the new application are sent to the network-based firewall, which inspects and examines these packets to identify their type, nature, and/or pertinent characteristics.
- a policy modification agent modifies the user's firewall policy to allow the new application to pass through firewall process of the network-based firewall unblocked.
- PMA sends an acknowledgement to the FFC of the completion of the modification.
- the FFC sends acknowledgement of the completion of the modification to the user.
- FIGS. 5A-5D are flowcharts depicting more specific functionality (or methods), in accordance with a preferred embodiment, of an implementation of network firewall policy configuration facilitation.
- the process begins at 500 .
- a user utilizing their processing device or other device, sends notification to a firewall facilitation coordinator (FFC) to modify the user's firewall policy.
- the FFC receives notification from the user's processing device to modify the user's firewall policy.
- the FFC authenticates the user via a database.
- a time window is generated by the FFC and at 508 , the time window is securely sent to a policy modification agent (PMA).
- PMA policy modification agent
- the PMA 140 receives a time window message from the FFC 108 .
- the PMA 140 authenticates and decrypts the message using the same secure method in which it was sent (e.g., SSL, SSH, IPsec), and determines if the time window is acceptable. At 509 , the PMA send an acknowledgement to the FFC. If the time window is acceptable, the PMA acknowledges the FFC with a positive acknowledgement. In an alternative preferred embodiment, when the PMA serves multiple FFCs, the PMA might also check a configured list of authorized FFCs so as to additionally determine that the FFC is authorized. If the time window is unacceptable, the PMA sends a negative acknowledgement.
- Negative acknowledgements may be necessary if for example, there is a problem with the PMA or firewall, or if there is a conflict of some kind such as the firewall is associated with multiple FFCs, and another FFC may have already requested, and been granted, the particular time window in question.
- the time window request from the FFC also includes the user identification so that the PMA can associate the request and time window with the particular user's firewall policy residing on the network-based firewall, which may serve a large number of users via separate unique policy rule-sets. Additional information will also be included in the time window request, for example the name or identifier of the “new” application so that this can be used to identify the specific new rules, which will be incorporated into the modified policy for this specific application, and also so that the blocking history can be readily checked for previous policy modification attempts associated with that application. The process continues on FIG. 5B .
- the FFC acknowledges the user.
- the acknowledgement informs the user regarding the time window, for instance indicating that the time window has successfully been granted and scheduled.
- the time window is granted by the PMA for a particular user and a particular “new” application
- the user runs (exercises) the new application during the time window.
- the PMA causes the firewall's packet inspection component to watch for packets from/to that user's processing device during the time window.
- the PMA checks the blocking history.
- the PMA keeps and consults a database of packets, which have been previously blocked. New policy rules have been added that reflect the “new” application, and of these, which have then been allowed via being included in the user's firewall policy.
- the PMA checks the blocking history to determine if the blocking history is acceptable. In an example, by checking this database the PMA can determine if any of the identified packets (e.g., to/from the user's processing device during the time window) are either (a) packets associated with applications already included in the user's firewall policy, or (b) packets, not included in the user's firewall policy, that have been previously encountered and blocked.
- such packets are categorized as “questionable” and will initially be excluded from the new firewall policy rules added for the “new” application.
- the firewall could block all questionable packets that are of the previously-blocked variety.
- the user's firewall policy is modified by adding new rules allowing the passage of the new application's packet types to the set of firewall policy rules.
- new rules may be modified from the pertinent aspects of the identified packets, such as the source and destination addresses, source and destination ports numbers, whether TCP or UDP packets, or other protocol numbers, etc.
- additional data can be utilized to help form the new firewall policy rules, as for example the type of application (e.g., Voice-over-IP, teleconferencing, or other application type which may indicate filtering information potentially pertinent to a firewall), which may be asked for and conveyed in the original user notification or request if appropriate.
- the PMA acknowledges the completion of the process to the FFC, which preferably relays the acknowledgement to the user.
- the new rule formation method or mechanism itself is simple (e.g., just rigorously matching the rule parameters to the identified aspects).
- the method or mechanism may be complex (e.g., potentially allowing some modification or variation or flexibility in parameters, based on a set of configurable if-then rules associated with various types of packets, protocols, and applications). If the user requests more modifications at 524 , the process continues at FIG. 5A , step 502 . If the user requests no more modifications, the process ends at 526 .
- the blocking history is not acceptable, meaning that one or more types of packets are observed that are questionable as defined previously, then steps must be taken to modify the policy to allow only the packet types needed for the proper operation of the new application as it communicates through the firewall, while encountering some difficulty in identifying these packet types and separating them from other questionable packets that might have been encountered. This can be done, but one or more additional successive policy modification attempts utilizing separate time windows may be required to accomplish it.
- the PMA on the 1 st attempt must modify the firewall policy without allowing any of the questionable packets since it is possible that these questionable packets have nothing to do with the new application and this possibility must be assumed initially.
- the PMA at 542 , first defines every possible group of questionable packet types, taken singly and also in every combination of two or more. This provides a set of questionable packet groups that may be added in one at a time in subsequent policy modification attempts, should subsequent attempts be necessary. Then at 544 , the PMA prioritizes these defined groups based on the likelihood that they will be required for the new application to function through the firewall, and also labels these groups as “Group 2 ,” “Group 3 ,” “Group 4 ,” . . . , up to “Group N max ” in order of priority.
- group number “ 2 ” will be the highest priority group, or that group deemed most likely to be necessary for the new application to function, while the highest numbered group will be the lowest priority group, or that group deemed least likely to be necessary for the new application to function.
- This prioritization may be accomplished using a set of rules or logic replicating or approximating the expertise of security experts in regard to such a prioritization. For example, certain types of packets or packets with certain characteristics are well know to be inherently dangerous or dangerous in some circumstances, while other packet types or characteristics are well known to be very uncommon, and yet other packet types or characteristics are well known to be seldom associated with applications or certain types of applications.
- the PMA at 546 , will then modify the firewall policy without allowing any of the questionable packet groups to be added.
- the PMA updates the blocking history by storing the questionable packet groups, the ordering of the groups, and the group labels in the blocking history database for use if subsequent attempts are needed or requested by the user/customer. For example, if the PMA finds one or more questionable packet types, the user's firewall policy is modified but the questionable packets are excluded by for example, filtering rules which would reflect these packets are not added to the user's rule-set.
- the PMA acknowledges to the FFC that the modification process is complete (with questionable packets excluded).
- the FFC acknowledges the completion of the modification process to the user and preferably alerting the user that, although the policy modification was successful, circumstances are such that some ambiguity was encountered and the user may need to repeat the process if the “new” application does not function properly through the firewall process. If the user finds that the application does not function, then the user can repeat the policy modification process via step 524 on FIG. 5C , and the process continues on FIG. 5A at step 502 with another notification sent by the user/customer to the FFC to modify the user's firewall policy.
- the application does not function well because one or more of the types of “questionable” packets are actually associated with the “new” application and are necessary for it to function, yet they are blocked by the firewall since new rules or modifications were not added in the 1 st policy modification attempt to the user/customer's policy to allow passage of these packets through the firewall. Therefore, on repeated policy modification attempts initiated by the user/customer, where the highest untried questionable packet group will be preferably identified by the PMA via searches of the blocking database, the PMA will try to include the proper set of packet types in the rule-set for the “new” application by adding in the “questionable” packet types, one at a time and subsequently, in combinations.
- the PMA chooses one of these and adds it into the user's firewall policy rule-set on the second attempt.
- the FFC, and thence the user, is acknowledged accordingly.
- the PMA will choose the other questionable packet type and add it into the user's firewall policy on the next attempt.
- the PMA may be configured to remove the first questionable packet type on this attempt, or to leave it in (and just add the second type).
- additional logic may be incorporated into the PMA to help it choose which types of “questionable” packets to add in to the firewall policy on repeated attempts.
- TCP packets could be incorporated into the rule-set before UDP packets
- low-numbered port packets could be added before high-numbered port packets
- known packet or protocol types could be added in before unknown types.
- step 538 is skipped and the process continues at step 540 . If no, then step 538 is not skipped, but instead the PMA at 538 removes the previously allowed questionable packet group, number (N ⁇ 1). Note that this is not possible on the 2 nd attempt since no questionable packet group was allowed to be added to firewall policy in the 1 st attempt, and thus there is nothing to remove in step 538 , hence step 538 is skipped on the 2 nd attempt as mentioned above.
- the PMA modifies the firewall policy of the user/customer by adding rules or modifications allowing the next highest priority questionable packet group, namely the group labeled N, the same number as the attempt number.
- the PMA updates the blocking history, as has been previously discussed in a number of aspects.
- the PMA acknowledges to the FFC that the modification process is complete (with questionable packets excluded).
- the FFC acknowledges the completion of the modification process to the user and preferably alerting the user that, although the policy modification was successful, circumstances are such that some ambiguity was encountered and the user may need to repeat the process if the “new” application does not function properly through the firewall process. If the user finds that the application does not function, then the user can repeat the policy modification process via step 524 on FIG. 5C , and the process continues on FIG. 5A at step 502 with another notification sent by the user/customer to the FFC to modify the user's firewall policy.
- the configured choice of how many re-tries would be allowed before the PMA “fails” the process is chosen based on the operations aspects of the system or service (e.g., how many helpdesk staff are available) and on some of the design particulars (e.g., whether additional/optional means are incorporated to aid the PMA in its choice of which questionable packets types are added first, in which combination, etc.).
- firewall policy rules is significant since a typical firewall checks the rules in order for a match with the packet currently being inspected or examined, such that certain orderings of rules may be “safer” than other ordering choices. That is, if a relatively safe ordering is used, then it is somewhat less critical to arrive at the exact set of rules for the application although this is preferable. Ultimately, the choice of how many repeats to allow the user hinges on how much effort or inconvenience is required from the user in extreme cases. Assuming that it is desirable to limit this inconvenience, a reasonably small number of repeats may be allowed.
- the user via appropriate acknowledgements and interactions, notifications or requests to the FFC is given the choice of repeating the process until the exact set of rules is found, regardless of how many repeated attempts is required.
- Each attempt makes some incremental progress toward the goal, so this is feasible no matter how many questionable packet types are recorded during the time window.
- Increased effort is required by the user since a large number of repeats (e.g., maybe up to 6 or 7 repeats) may be needed until the PMA can arrive at the exact rule-set for a particularly problematic “new” application.
- the PMA could be configured to continuously, periodically or randomly watch for patterns in the packet flow associated with each of the user's applications.
- new types of packets are noticed by the firewall's packet inspector (and thus by the PMA)
- this information is conveyed to the user indicating that the user may now wish to or need to repeat the policy modification process.
- the user may eventually notice a problem with an application, since the new packet types are likely to be blocked by the firewall, resulting in some outward sign to the user.
- providing specific notification to the user immediately, spares the user from having to try to figure out what is wrong, especially since the user may incorrectly assume that the firewall policy is not to blame, e.g. that the policy was “taken care of” previously and so can now be ignored.
- Preferred embodiments of this invention provide a user with knowledge that a firewall policy is no longer accurate for a given application allows the user to repeat the modification process for the affected application, thereby fixing problems and enabling firewall compatibility with minimal effort while maintaining maximum security. Otherwise the user may turn off a firewall completely, which results in a complete lack of security.
- the user at their discretion can repeat the firewall policy modification process for a particular application at any time, in which case the PMA will be able to recognize by via consulting the blocking database that the attempt is for an application that has already been incorporated into the user's firewall policy, and will act accordingly when modifying the user's rule-set.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Business, Economics & Management (AREA)
- General Business, Economics & Management (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Computer And Data Communications (AREA)
Abstract
Description
Claims (44)
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/611,635 US7328451B2 (en) | 2003-06-30 | 2003-06-30 | Network firewall policy configuration facilitation |
US12/025,412 US7814539B2 (en) | 2003-06-30 | 2008-02-04 | Network firewall policy configuration facilitation |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/611,635 US7328451B2 (en) | 2003-06-30 | 2003-06-30 | Network firewall policy configuration facilitation |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US12/025,412 Continuation US7814539B2 (en) | 2003-06-30 | 2008-02-04 | Network firewall policy configuration facilitation |
Publications (2)
Publication Number | Publication Date |
---|---|
US20040268150A1 US20040268150A1 (en) | 2004-12-30 |
US7328451B2 true US7328451B2 (en) | 2008-02-05 |
Family
ID=33541357
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/611,635 Active 2025-11-11 US7328451B2 (en) | 2003-06-30 | 2003-06-30 | Network firewall policy configuration facilitation |
US12/025,412 Expired - Lifetime US7814539B2 (en) | 2003-06-30 | 2008-02-04 | Network firewall policy configuration facilitation |
Family Applications After (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US12/025,412 Expired - Lifetime US7814539B2 (en) | 2003-06-30 | 2008-02-04 | Network firewall policy configuration facilitation |
Country Status (1)
Country | Link |
---|---|
US (2) | US7328451B2 (en) |
Cited By (26)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20050183130A1 (en) * | 2004-02-12 | 2005-08-18 | Sadja Aran L. | Cable diagnostic and monitoring system |
US20060039341A1 (en) * | 2004-08-18 | 2006-02-23 | Henry Ptasinski | Method and system for exchanging setup configuration protocol information in beacon frames in a WLAN |
US20060161965A1 (en) * | 2005-01-19 | 2006-07-20 | Microsoft Corporation | Method and system for separating rules of a security policy from detection criteria |
US20060174318A1 (en) * | 2005-01-28 | 2006-08-03 | Microsoft Corporation | Method and system for troubleshooting when a program is adversely impacted by a security policy |
US20070014276A1 (en) * | 2005-07-12 | 2007-01-18 | Cisco Technology, Inc., A California Corporation | Route processor adjusting of line card admission control parameters for packets destined for the route processor |
US20070014275A1 (en) * | 2005-07-12 | 2007-01-18 | Cisco Technology, Inc. A California Corporation | Dynamically controlling the rate and internal priority of packets destined for the control plane of a routing device |
US20070016945A1 (en) * | 2005-07-15 | 2007-01-18 | Microsoft Corporation | Automatically generating rules for connection security |
US20070294601A1 (en) * | 2006-05-19 | 2007-12-20 | Microsoft Corporation | Watchdog processors in multicore systems |
US20080056502A1 (en) * | 2006-09-04 | 2008-03-06 | Konica Minolta Business Technologies, Inc. | Application program distributing apparatus, image processing apparatus and program, allowing data communications using S/MIME at ease |
US20080109871A1 (en) * | 2006-09-13 | 2008-05-08 | Richard Jacobs | Policy management |
US20100138893A1 (en) * | 2008-12-02 | 2010-06-03 | Inventec Corporation | Processing method for accelerating packet filtering |
US20100333165A1 (en) * | 2009-06-24 | 2010-12-30 | Vmware, Inc. | Firewall configured with dynamic membership sets representing machine attributes |
US20110194549A1 (en) * | 2004-08-18 | 2011-08-11 | Manoj Thawani | Method and System for Improved Communication Network Setup Utilizing Extended Terminals |
US8806605B1 (en) * | 2008-01-11 | 2014-08-12 | Juniper Networks, Inc. | Provisioning network access through a firewall |
US20140282823A1 (en) * | 2013-03-15 | 2014-09-18 | Enterasys Networks, Inc. | Device and related method for establishing network policy based on applications |
US20140370860A1 (en) * | 2005-06-03 | 2014-12-18 | Good Technology Software, Inc. | System and method for monitoring and maintaining a wireless device |
US9130826B2 (en) | 2013-03-15 | 2015-09-08 | Enterasys Networks, Inc. | System and related method for network monitoring and control based on applications |
US9172627B2 (en) | 2013-03-15 | 2015-10-27 | Extreme Networks, Inc. | Device and related method for dynamic traffic mirroring |
US9230213B2 (en) | 2013-03-15 | 2016-01-05 | Extreme Networks, Inc. | Device and related method for scoring applications running on a network |
US9256636B2 (en) | 2013-03-15 | 2016-02-09 | Extreme Networks, Inc. | Device and related method for application identification |
US9584393B2 (en) | 2013-03-15 | 2017-02-28 | Extreme Networks, Inc. | Device and related method for dynamic traffic mirroring policy |
WO2017151375A1 (en) * | 2016-02-29 | 2017-09-08 | Level 3 Communications, Llc | Systems and methods for dynamic firewall policy configuration |
US10218676B2 (en) | 2003-12-31 | 2019-02-26 | Cap Co., Ltd. | Flexible network security system and method for permitting trusted process |
US10878110B2 (en) | 2017-09-12 | 2020-12-29 | Sophos Limited | Dashboard for managing enterprise network traffic |
US11330017B2 (en) * | 2017-02-09 | 2022-05-10 | Alcatel Lucent | Method and device for providing a security service |
US11516181B2 (en) * | 2003-11-17 | 2022-11-29 | Mcafee, Llc | Device, system and method for defending a computer network |
Families Citing this family (59)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8972590B2 (en) * | 2000-09-14 | 2015-03-03 | Kirsten Aldrich | Highly accurate security and filtering software |
US8209756B1 (en) | 2002-02-08 | 2012-06-26 | Juniper Networks, Inc. | Compound attack detection in a computer network |
JP3758661B2 (en) * | 2003-11-17 | 2006-03-22 | 株式会社インテリジェントウェイブ | Fraud monitoring program, fraud monitoring method and fraud monitoring system |
US8036358B2 (en) * | 2004-03-09 | 2011-10-11 | Siemens Enterprise Communications, Inc. | Distributed voice conferencing |
US7543330B2 (en) * | 2004-04-08 | 2009-06-02 | International Business Machines Corporation | Method and apparatus for governing the transfer of physiological and emotional user data |
US7870297B1 (en) * | 2004-04-16 | 2011-01-11 | Symantec Corporation | Organizing computer network identifications and concurrent application of policy selectors |
US7567560B1 (en) * | 2004-04-28 | 2009-07-28 | Cisco Technology, Inc. | System and method for securing a communication network |
US20060026674A1 (en) * | 2004-08-02 | 2006-02-02 | Ward Mark K | Firewall port search system |
US7475424B2 (en) * | 2004-09-02 | 2009-01-06 | International Business Machines Corporation | System and method for on-demand dynamic control of security policies/rules by a client computing device |
US7478424B2 (en) * | 2004-11-30 | 2009-01-13 | Cymtec Systems, Inc. | Propagation protection within a network |
US7725935B1 (en) * | 2004-12-17 | 2010-05-25 | Symantec Corporation | Detecting worms |
US7809826B1 (en) | 2005-01-27 | 2010-10-05 | Juniper Networks, Inc. | Remote aggregation of network traffic profiling data |
US7769851B1 (en) | 2005-01-27 | 2010-08-03 | Juniper Networks, Inc. | Application-layer monitoring and profiling network traffic |
US7937755B1 (en) * | 2005-01-27 | 2011-05-03 | Juniper Networks, Inc. | Identification of network policy violations |
US7797411B1 (en) | 2005-02-02 | 2010-09-14 | Juniper Networks, Inc. | Detection and prevention of encapsulated network attacks using an intermediate device |
CN1905555B (en) * | 2005-07-30 | 2010-07-07 | 华为技术有限公司 | Fire wall controlling system and method based on NGN service |
US8914868B2 (en) * | 2006-03-03 | 2014-12-16 | Hewlett-Packard Development Company, L.P. | Vendor-neutral policy based mechanism for enabling firewall service in an MPLS-VPN service network |
WO2007116605A1 (en) * | 2006-03-30 | 2007-10-18 | Nec Corporation | Communication terminal, rule distribution apparatus and program |
US8856860B2 (en) * | 2006-08-18 | 2014-10-07 | Cisco Technology, Inc. | System and method for implementing policy server based application interaction manager |
US7954143B2 (en) * | 2006-11-13 | 2011-05-31 | At&T Intellectual Property I, Lp | Methods, network services, and computer program products for dynamically assigning users to firewall policy groups |
US8812579B2 (en) * | 2006-12-21 | 2014-08-19 | Verizon Patent And Licensing Inc. | Apparatus for transferring data via a proxy server and an associated method and computer program product |
US8584227B2 (en) * | 2007-05-09 | 2013-11-12 | Microsoft Corporation | Firewall with policy hints |
US8443433B2 (en) * | 2007-06-28 | 2013-05-14 | Microsoft Corporation | Determining a merged security policy for a computer system |
US8291495B1 (en) | 2007-08-08 | 2012-10-16 | Juniper Networks, Inc. | Identifying applications for intrusion detection systems |
US8112800B1 (en) | 2007-11-08 | 2012-02-07 | Juniper Networks, Inc. | Multi-layered application classification and decoding |
US8347374B2 (en) * | 2007-11-15 | 2013-01-01 | Red Hat, Inc. | Adding client authentication to networked communications |
US10372924B2 (en) * | 2008-05-12 | 2019-08-06 | George Madathilparambil George | Master device for controlling application security environments |
US8856926B2 (en) * | 2008-06-27 | 2014-10-07 | Juniper Networks, Inc. | Dynamic policy provisioning within network security devices |
US8819201B2 (en) * | 2008-08-07 | 2014-08-26 | At&T Intellectual Property I, L.P. | Method and apparatus for providing routing and access control filters |
US8572717B2 (en) * | 2008-10-09 | 2013-10-29 | Juniper Networks, Inc. | Dynamic access control policy with port restrictions for a network security appliance |
US9398043B1 (en) | 2009-03-24 | 2016-07-19 | Juniper Networks, Inc. | Applying fine-grain policy action to encapsulated network attacks |
US8468113B2 (en) | 2009-05-18 | 2013-06-18 | Tufin Software Technologies Ltd. | Method and system for management of security rule set |
IL205815A0 (en) * | 2009-05-18 | 2010-11-30 | Tufin Software Technologies Ltd | Method and system for management of security rule set |
US9473460B2 (en) * | 2009-06-22 | 2016-10-18 | Microsoft Technology Licensing, Llc | Using hypertext transfer protocol as a transport for bi-directional data streams |
US8381281B2 (en) * | 2010-04-07 | 2013-02-19 | International Business Machines Corporation | Authenticating a remote host to a firewall |
US8914841B2 (en) * | 2010-11-24 | 2014-12-16 | Tufin Software Technologies Ltd. | Method and system for mapping between connectivity requests and a security rule set |
US9100366B2 (en) * | 2012-09-13 | 2015-08-04 | Cisco Technology, Inc. | Early policy evaluation of multiphase attributes in high-performance firewalls |
US9215213B2 (en) * | 2014-02-20 | 2015-12-15 | Nicira, Inc. | Method and apparatus for distributing firewall rules |
FR3019417B1 (en) * | 2014-03-26 | 2017-07-07 | Bull Sas | METHOD FOR PROCESSING A MESSAGE IN AN INTERCONNECTION DEVICE |
US9762443B2 (en) | 2014-04-15 | 2017-09-12 | Splunk Inc. | Transformation of network data at remote capture agents |
US9838512B2 (en) | 2014-10-30 | 2017-12-05 | Splunk Inc. | Protocol-based capture of network data using remote capture agents |
US10127273B2 (en) | 2014-04-15 | 2018-11-13 | Splunk Inc. | Distributed processing of network data using remote capture agents |
US10462004B2 (en) | 2014-04-15 | 2019-10-29 | Splunk Inc. | Visualizations of statistics associated with captured network data |
US10523521B2 (en) | 2014-04-15 | 2019-12-31 | Splunk Inc. | Managing ephemeral event streams generated from captured network data |
US10693742B2 (en) | 2014-04-15 | 2020-06-23 | Splunk Inc. | Inline visualizations of metrics related to captured network data |
US12028208B1 (en) | 2014-05-09 | 2024-07-02 | Splunk Inc. | Selective event stream data storage based on network traffic volume |
US9596253B2 (en) | 2014-10-30 | 2017-03-14 | Splunk Inc. | Capture triggers for capturing network data |
US9838354B1 (en) * | 2015-06-26 | 2017-12-05 | Juniper Networks, Inc. | Predicting firewall rule ranking value |
US10075416B2 (en) | 2015-12-30 | 2018-09-11 | Juniper Networks, Inc. | Network session data sharing |
US10142290B1 (en) * | 2016-03-30 | 2018-11-27 | Amazon Technologies, Inc. | Host-based firewall for distributed computer systems |
US10333962B1 (en) | 2016-03-30 | 2019-06-25 | Amazon Technologies, Inc. | Correlating threat information across sources of distributed computing systems |
US10178119B1 (en) | 2016-03-30 | 2019-01-08 | Amazon Technologies, Inc. | Correlating threat information across multiple levels of distributed computing systems |
US10148675B1 (en) | 2016-03-30 | 2018-12-04 | Amazon Technologies, Inc. | Block-level forensics for distributed computing systems |
CN107391277B (en) * | 2017-07-17 | 2021-06-29 | 北京京东尚科信息技术有限公司 | Information processing method and device |
US11245668B1 (en) * | 2019-03-06 | 2022-02-08 | Juniper Networks, Inc. | Critical firewall functionality management |
US11310202B2 (en) | 2019-03-13 | 2022-04-19 | Vmware, Inc. | Sharing of firewall rules among multiple workloads in a hypervisor |
US11165750B1 (en) * | 2019-03-29 | 2021-11-02 | Juniper Networks, Inc. | Flexible services-based pipeline for firewall filter processing |
CN112787867B (en) * | 2021-01-25 | 2023-02-10 | 上海瀚银信息技术有限公司 | Automatic processing system and method for firewall policy tasks |
US20240154980A1 (en) * | 2022-11-09 | 2024-05-09 | Netflow, UAB | Use Of Dynamically Modifiable Rules In A Computing And Communications System |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6243815B1 (en) * | 1997-04-25 | 2001-06-05 | Anand K. Antur | Method and apparatus for reconfiguring and managing firewalls and security devices |
US20020040396A1 (en) * | 2000-09-29 | 2002-04-04 | Kddi Corporation | Management device and managed device in policy based management system |
US20020194495A1 (en) * | 2001-06-14 | 2002-12-19 | Gladstone Philip J.S. | Stateful distributed event processing and adaptive security |
GB2380279A (en) * | 2001-10-01 | 2003-04-02 | Soundvoice Ltd | Computer firewall system user interface |
Family Cites Families (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6279113B1 (en) * | 1998-03-16 | 2001-08-21 | Internet Tools, Inc. | Dynamic signature inspection-based network intrusion detection |
US6728885B1 (en) * | 1998-10-09 | 2004-04-27 | Networks Associates Technology, Inc. | System and method for network access control using adaptive proxies |
US7107612B1 (en) * | 1999-04-01 | 2006-09-12 | Juniper Networks, Inc. | Method, apparatus and computer program product for a network firewall |
WO2002015479A1 (en) * | 2000-08-11 | 2002-02-21 | British Telecommunications Public Limited Company | System and method of detecting events |
US20020116611A1 (en) * | 2000-10-31 | 2002-08-22 | Cornell Research Foundation, Inc. | Secure distributed on-line certification authority |
US7296292B2 (en) * | 2000-12-15 | 2007-11-13 | International Business Machines Corporation | Method and apparatus in an application framework system for providing a port and network hardware resource firewall for distributed applications |
-
2003
- 2003-06-30 US US10/611,635 patent/US7328451B2/en active Active
-
2008
- 2008-02-04 US US12/025,412 patent/US7814539B2/en not_active Expired - Lifetime
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6243815B1 (en) * | 1997-04-25 | 2001-06-05 | Anand K. Antur | Method and apparatus for reconfiguring and managing firewalls and security devices |
US20020040396A1 (en) * | 2000-09-29 | 2002-04-04 | Kddi Corporation | Management device and managed device in policy based management system |
US20020194495A1 (en) * | 2001-06-14 | 2002-12-19 | Gladstone Philip J.S. | Stateful distributed event processing and adaptive security |
GB2380279A (en) * | 2001-10-01 | 2003-04-02 | Soundvoice Ltd | Computer firewall system user interface |
Non-Patent Citations (1)
Title |
---|
Cisco Systems, Understanding Security Policies, Sep. 28, 2002, pp. 1-9, retrieved date Nov. 18, 2006;□□http://www.cisco.com/univercd/cc/td/doc/product/iaabu/centri4/user/scf4ch4.pdf. * |
Cited By (66)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11516181B2 (en) * | 2003-11-17 | 2022-11-29 | Mcafee, Llc | Device, system and method for defending a computer network |
US10972432B2 (en) | 2003-12-31 | 2021-04-06 | Cap Co., Ltd. | Flexible network security system and method for permitting trusted process |
US10218676B2 (en) | 2003-12-31 | 2019-02-26 | Cap Co., Ltd. | Flexible network security system and method for permitting trusted process |
US8413200B2 (en) | 2004-02-12 | 2013-04-02 | Sony Corporation | Cable television viewing statistics |
US8352995B2 (en) | 2004-02-12 | 2013-01-08 | Sony Corporation | Polling cable diagnostic and monitoring system that aggregates responses from multiple terminals |
US20050183130A1 (en) * | 2004-02-12 | 2005-08-18 | Sadja Aran L. | Cable diagnostic and monitoring system |
US20110099569A1 (en) * | 2004-02-12 | 2011-04-28 | Aran London Sadja | Cable Diagnostic and Monitoring System |
US20110099570A1 (en) * | 2004-02-12 | 2011-04-28 | Aran London Sadja | Cable Diagnostic and Monitoring System |
US7895632B2 (en) * | 2004-02-12 | 2011-02-22 | Sony Corporation | Cable diagnostic and monitoring system |
US7987499B2 (en) * | 2004-08-18 | 2011-07-26 | Broadcom Corporation | Method and system for exchanging setup configuration protocol information in beacon frames in a WLAN |
US8640217B2 (en) | 2004-08-18 | 2014-01-28 | Broadcom Corporation | Method and system for improved communication network setup utilizing extended terminals |
US20060039341A1 (en) * | 2004-08-18 | 2006-02-23 | Henry Ptasinski | Method and system for exchanging setup configuration protocol information in beacon frames in a WLAN |
US20110194549A1 (en) * | 2004-08-18 | 2011-08-11 | Manoj Thawani | Method and System for Improved Communication Network Setup Utilizing Extended Terminals |
US20060161965A1 (en) * | 2005-01-19 | 2006-07-20 | Microsoft Corporation | Method and system for separating rules of a security policy from detection criteria |
US7591010B2 (en) | 2005-01-19 | 2009-09-15 | Microsoft Corporation | Method and system for separating rules of a security policy from detection criteria |
US7707619B2 (en) * | 2005-01-28 | 2010-04-27 | Microsoft Corporation | Method and system for troubleshooting when a program is adversely impacted by a security policy |
US20060174318A1 (en) * | 2005-01-28 | 2006-08-03 | Microsoft Corporation | Method and system for troubleshooting when a program is adversely impacted by a security policy |
US20140370860A1 (en) * | 2005-06-03 | 2014-12-18 | Good Technology Software, Inc. | System and method for monitoring and maintaining a wireless device |
US9432871B2 (en) * | 2005-06-03 | 2016-08-30 | Good Technology Corporation | System and method for monitoring and maintaining a wireless device |
US20070014275A1 (en) * | 2005-07-12 | 2007-01-18 | Cisco Technology, Inc. A California Corporation | Dynamically controlling the rate and internal priority of packets destined for the control plane of a routing device |
US20070014276A1 (en) * | 2005-07-12 | 2007-01-18 | Cisco Technology, Inc., A California Corporation | Route processor adjusting of line card admission control parameters for packets destined for the route processor |
US7522521B2 (en) * | 2005-07-12 | 2009-04-21 | Cisco Technology, Inc. | Route processor adjusting of line card admission control parameters for packets destined for the route processor |
US8325607B2 (en) | 2005-07-12 | 2012-12-04 | Cisco Technology, Inc. | Rate controlling of packets destined for the route processor |
US7580351B2 (en) | 2005-07-12 | 2009-08-25 | Cisco Technology, Inc | Dynamically controlling the rate and internal priority of packets destined for the control plane of a routing device |
US20090201808A1 (en) * | 2005-07-12 | 2009-08-13 | Cisco Technology, Inc., A Corporation Of California | Rate Controlling of Packets Destined for the Route Processor |
US20070016945A1 (en) * | 2005-07-15 | 2007-01-18 | Microsoft Corporation | Automatically generating rules for connection security |
US8056124B2 (en) * | 2005-07-15 | 2011-11-08 | Microsoft Corporation | Automatically generating rules for connection security |
US8490153B2 (en) | 2005-07-15 | 2013-07-16 | Microsoft Corporation | Automatically generating rules for connection security |
US7958396B2 (en) * | 2006-05-19 | 2011-06-07 | Microsoft Corporation | Watchdog processors in multicore systems |
US20070294601A1 (en) * | 2006-05-19 | 2007-12-20 | Microsoft Corporation | Watchdog processors in multicore systems |
US8559641B2 (en) * | 2006-09-04 | 2013-10-15 | Konica Minolta Business Technologies, Inc. | Application program distributing apparatus, image processing apparatus and program, allowing data communications using S/MIME at ease |
US20080056502A1 (en) * | 2006-09-04 | 2008-03-06 | Konica Minolta Business Technologies, Inc. | Application program distributing apparatus, image processing apparatus and program, allowing data communications using S/MIME at ease |
US20080109871A1 (en) * | 2006-09-13 | 2008-05-08 | Richard Jacobs | Policy management |
US10979459B2 (en) | 2006-09-13 | 2021-04-13 | Sophos Limited | Policy management |
US10333990B2 (en) | 2006-09-13 | 2019-06-25 | Sophos Limited | Policy management |
US9860274B2 (en) * | 2006-09-13 | 2018-01-02 | Sophos Limited | Policy management |
US10333989B2 (en) | 2006-09-13 | 2019-06-25 | Sophos Limited | Policy management |
US9350704B2 (en) | 2008-01-11 | 2016-05-24 | Juniper Networks, Inc. | Provisioning network access through a firewall |
US8806605B1 (en) * | 2008-01-11 | 2014-08-12 | Juniper Networks, Inc. | Provisioning network access through a firewall |
US20100138893A1 (en) * | 2008-12-02 | 2010-06-03 | Inventec Corporation | Processing method for accelerating packet filtering |
US20100333165A1 (en) * | 2009-06-24 | 2010-12-30 | Vmware, Inc. | Firewall configured with dynamic membership sets representing machine attributes |
US9621516B2 (en) | 2009-06-24 | 2017-04-11 | Vmware, Inc. | Firewall configured with dynamic membership sets representing machine attributes |
US20140282823A1 (en) * | 2013-03-15 | 2014-09-18 | Enterasys Networks, Inc. | Device and related method for establishing network policy based on applications |
US9230213B2 (en) | 2013-03-15 | 2016-01-05 | Extreme Networks, Inc. | Device and related method for scoring applications running on a network |
US10212224B2 (en) | 2013-03-15 | 2019-02-19 | Extreme Networks, Inc. | Device and related method for dynamic traffic mirroring |
US9130826B2 (en) | 2013-03-15 | 2015-09-08 | Enterasys Networks, Inc. | System and related method for network monitoring and control based on applications |
US9584393B2 (en) | 2013-03-15 | 2017-02-28 | Extreme Networks, Inc. | Device and related method for dynamic traffic mirroring policy |
US9256636B2 (en) | 2013-03-15 | 2016-02-09 | Extreme Networks, Inc. | Device and related method for application identification |
US9813447B2 (en) * | 2013-03-15 | 2017-11-07 | Extreme Networks, Inc. | Device and related method for establishing network policy based on applications |
US10735511B2 (en) | 2013-03-15 | 2020-08-04 | Extreme Networks, Inc. | Device and related method for dynamic traffic mirroring |
US9172627B2 (en) | 2013-03-15 | 2015-10-27 | Extreme Networks, Inc. | Device and related method for dynamic traffic mirroring |
US10462104B2 (en) | 2016-02-29 | 2019-10-29 | Level 3 Communications, Llc | Systems and methods for dynamic firewall policy configuration |
US12028317B2 (en) | 2016-02-29 | 2024-07-02 | Level 3 Communications, Llc | Systems and methods for dynamic firewall policy configuration |
US10771432B2 (en) | 2016-02-29 | 2020-09-08 | Level 3 Communications, Llc | Systems and methods for dynamic firewall policy configuration |
US11777901B2 (en) | 2016-02-29 | 2023-10-03 | Level 3 Communications, Llc | Systems and methods for dynamic firewall policy configuration |
WO2017151375A1 (en) * | 2016-02-29 | 2017-09-08 | Level 3 Communications, Llc | Systems and methods for dynamic firewall policy configuration |
US11477162B2 (en) | 2016-02-29 | 2022-10-18 | Level 3 Communications, Llc | Systems and methods for dynamic firewall policy configuration |
US11330017B2 (en) * | 2017-02-09 | 2022-05-10 | Alcatel Lucent | Method and device for providing a security service |
US10997303B2 (en) | 2017-09-12 | 2021-05-04 | Sophos Limited | Managing untyped network traffic flows |
US11093624B2 (en) | 2017-09-12 | 2021-08-17 | Sophos Limited | Providing process data to a data recorder |
US11017102B2 (en) | 2017-09-12 | 2021-05-25 | Sophos Limited | Communicating application information to a firewall |
US11620396B2 (en) | 2017-09-12 | 2023-04-04 | Sophos Limited | Secure firewall configurations |
US10885211B2 (en) | 2017-09-12 | 2021-01-05 | Sophos Limited | Securing interprocess communications |
US11966482B2 (en) | 2017-09-12 | 2024-04-23 | Sophos Limited | Managing untyped network traffic flows |
US10878110B2 (en) | 2017-09-12 | 2020-12-29 | Sophos Limited | Dashboard for managing enterprise network traffic |
US12039036B2 (en) | 2017-09-12 | 2024-07-16 | Sophos Limited | Secure firewall configurations |
Also Published As
Publication number | Publication date |
---|---|
US20040268150A1 (en) | 2004-12-30 |
US20080172731A1 (en) | 2008-07-17 |
US7814539B2 (en) | 2010-10-12 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7328451B2 (en) | Network firewall policy configuration facilitation | |
US8590035B2 (en) | Network firewall host application identification and authentication | |
US9503477B2 (en) | Network policy assignment based on user reputation score | |
US8938799B2 (en) | Security protection apparatus and method for endpoint computing systems | |
CN110691107B (en) | Endogenous safety user access authentication management system and method | |
KR100989487B1 (en) | Method for authenticating a user to a service of a service provider | |
USRE45326E1 (en) | Systems and methods for securing computers | |
US7047424B2 (en) | Methods and systems for hairpins in virtual networks | |
US7028334B2 (en) | Methods and systems for using names in virtual networks | |
US7310669B2 (en) | Network appliance for vulnerability assessment auditing over multiple networks | |
US8713665B2 (en) | Systems, methods, and media for firewall control via remote system information | |
US8219496B2 (en) | Method of and apparatus for ascertaining the status of a data processing environment | |
US8166310B2 (en) | Method and apparatus for providing temporary access to a network device | |
EP2196933B1 (en) | Server-to-server integrity checking | |
US7047562B2 (en) | Conditioning of the execution of an executable program upon satisfaction of criteria | |
US20020026531A1 (en) | Methods and systems for enabling communication between a processor and a network operations center | |
US20080172347A1 (en) | Method and sysem for utilizing an expert system to determine whether to alter a firewall configuration | |
US20050182969A1 (en) | Periodic filesystem integrity checks | |
US11770403B2 (en) | Determination of a security rating of a network element | |
WO2001080521A2 (en) | Methods and system for providing network services using at least one processor interfacing a base network | |
US20210385183A1 (en) | Multi-factor authentication for accessing an electronic mail | |
US20070150947A1 (en) | Method and apparatus for enhancing security on an enterprise network | |
CN108712376A (en) | A kind of verification method and device for server log | |
CN109413107A (en) | A kind of credible platform connection method | |
Geissler et al. | Applying security standards to multi agent systems |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: BELLSOUTH INTELLECTUAL PROPERTY CORP., DELAWARE Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:AARON, JEFFREY A.;REEL/FRAME:014693/0607 Effective date: 20030801 |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
FEPP | Fee payment procedure |
Free format text: PAYER NUMBER DE-ASSIGNED (ORIGINAL EVENT CODE: RMPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY |
|
FPAY | Fee payment |
Year of fee payment: 4 |
|
AS | Assignment |
Owner name: AT&T INTELLECTUAL PROPERTY I, L.P., GEORGIA Free format text: NUNC PRO TUNC ASSIGNMENT;ASSIGNOR:AT&T DELAWARE INTELLECTUAL PROPERTY, INC.;REEL/FRAME:026810/0547 Effective date: 20110815 |
|
AS | Assignment |
Owner name: AT&T BLS INTELLECTUAL PROPERTY, INC., DELAWARE Free format text: CHANGE OF NAME;ASSIGNOR:AT&T INTELLECTUAL PROPERTY, INC.;REEL/FRAME:027242/0076 Effective date: 20070725 Owner name: AT&T DELAWARE INTELLECTUAL PROPERTY, INC., DELAWAR Free format text: CHANGE OF NAME;ASSIGNOR:AT&T BLS INTELLECTUAL PROPERTY, INC.;REEL/FRAME:027242/0089 Effective date: 20071030 Owner name: WORCESTER TECHNOLOGIES LLC, DELAWARE Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:AT&T INTELLECTUAL PROPERTY I, LP;REEL/FRAME:027241/0681 Effective date: 20110923 Owner name: AT&T INTELLECTUAL PROPERTY, INC., DELAWARE Free format text: CHANGE OF NAME;ASSIGNOR:BELLSOUTH INTELLECTUAL PROPERTY CORPORATION;REEL/FRAME:027242/0038 Effective date: 20070425 |
|
AS | Assignment |
Owner name: INTELLECTUAL VENTURES II LLC, DELAWARE Free format text: MERGER;ASSIGNOR:WORCESTER TECHNOLOGIES LLC;REEL/FRAME:030638/0027 Effective date: 20130523 |
|
FPAY | Fee payment |
Year of fee payment: 8 |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 12TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1553); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 12 |
|
AS | Assignment |
Owner name: INTELLECTUAL VENTURES ASSETS 3 LLC, DELAWARE Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:INTELLECTUAL VENTURES II LLC;REEL/FRAME:055989/0809 Effective date: 20200922 |